# CWE-331.

Every Advisory and CVE whose sources give the weakness CWE-331, newest first.

## Records, newest first

- [NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-92209.md)
  `CVE-2026-92209` · CVE record: NoMachine NoMachine · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-331
- [diem-project diem dmString.php random weak prng](https://agentprime.io/advisories/CVE-2026-112041.md)
  `CVE-2026-112041` · CVE record: diem-project diem · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS, CWE-331
- [Synology DiskStation Manager (DSM): An insufficient entropy vulnerability in login logic in Synology DiskStation Manager…](https://agentprime.io/advisories/CVE-2026-13639.md)
  `CVE-2026-13639` · CVE record: Synology DiskStation Manager (DSM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-331
- [LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key](https://agentprime.io/advisories/CVE-2026-90562.md)
  `CVE-2026-90562` · CVE record: langbot-app LangBot · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: CWE-331
- [Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Entropy in PRNG vulnerability.](https://agentprime.io/advisories/CVE-2026-80171.md)
  `CVE-2026-80171` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-331
- [A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70).](https://agentprime.io/advisories/CVE-2026-62646.md)
  `CVE-2026-62646` · CVE record: Siemens Reyrolle 7SR5 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-331
- [Combodo iTop: Weak secret generation for inline image](https://agentprime.io/advisories/CVE-2026-27490.md)
  `CVE-2026-27490` · CVE record: Combodo iTop · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Weak cryptography or TLS, CWE-331
- [Power System Insufficient Entropy](https://agentprime.io/advisories/CVE-2026-4936.md)
  `CVE-2026-4936` · CVE record: IBM PowerVM Hypervisor · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-331
- [Power System Insufficient Entropy](https://agentprime.io/advisories/CVE-2026-4937.md)
  `CVE-2026-4937` · CVE record: IBM PowerVM Hypervisor · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-331
- [pkp pkp-lib API Key Generation APIProfileForm.php setData entropy](https://agentprime.io/advisories/CVE-2026-19906.md)
  `CVE-2026-19906` · CVE record: pkp pkp-lib · CVSS 6.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Weak cryptography or TLS, CWE-331
- [Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy](https://agentprime.io/advisories/CVE-2026-19748.md)
  `CVE-2026-19748` · CVE record: Tenda CH7 and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Weak cryptography or TLS, CWE-331
- [crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain](https://agentprime.io/advisories/GHSA-rg76-677x-56q9.md)
  `GHSA-rg76-677x-56q9`, `CVE-2026-71851` · npm `crypto-js`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: Weak cryptography or TLS, CWE-331, CWE-334
- [Weak Session Key Generation in TP-Link Omada Adoption Protocol](https://agentprime.io/advisories/CVE-2025-15629.md)
  `CVE-2025-15629` · CVE record: TP-Link Systems Inc. Omada Gateways and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-331
- [osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.](https://agentprime.io/advisories/CVE-2026-38447.md)
  `CVE-2026-38447` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-331
- [This Power System update is being released to address Insufficient Entropy](https://agentprime.io/advisories/CVE-2026-4932.md)
  `CVE-2026-4932` · CVE record: IBM PowerVM Hypervisor · CVSS 4.2 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-331
- [Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation](https://agentprime.io/advisories/CVE-2026-11403.md)
  `CVE-2026-11403` · CVE record: Sonatype Nexus Repository Manager · CVSS 8.7 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-331
- [Insufficient Entropy in Raspberry Pi 5 and Compute Module 5](https://agentprime.io/advisories/CVE-2026-13199.md)
  `CVE-2026-13199` · CVE record: Raspberry Pi Raspberry Pi 5 and Compute Module 5 · CVSS 5.1 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-331
- [DPA Countermeasures weakening on Series 3 devices](https://agentprime.io/advisories/CVE-2026-4930.md)
  `CVE-2026-4930` · CVE record: silabs.com Simplicity SDK · CVSS 7.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-331
- [Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand](https://agentprime.io/advisories/CVE-2026-46473.md)
  `CVE-2026-46473` · CVE record: TCHATZI Authen::TOTP · CVSS 7.5 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-331
- [Crypt::DSA versions before 1.20 for Perl generate seeds using rand](https://agentprime.io/advisories/CVE-2026-8700.md)
  `CVE-2026-8700` · CVE record: TIMLEGGE Crypt::DSA · CVSS 7.3 High · Not analysed yet · Published 15 May 2026 · Tags: CWE-331
- [Trog::TOTP versions before 1.006 for Perl generate secrets using rand](https://agentprime.io/advisories/CVE-2026-46474.md)
  `CVE-2026-46474` · CVE record: TEODESIAN Trog::TOTP · CVSS 7.5 High · Not analysed yet · Published 15 May 2026 · Tags: CWE-331
- [Insufficient DPA countermeasure reseeding](https://agentprime.io/advisories/CVE-2025-14972.md)
  `CVE-2025-14972` · CVE record: silabs.com Simplicity SDK · CVSS 4.1 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-331
- [Insufficient Entropy vulnerability on Multiple Products](https://agentprime.io/advisories/CVE-2026-4827.md)
  `CVE-2026-4827` · CVE record: Schneider Electric Easergy MiCOM C264 and 4 more · CVSS 8.7 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-331
- [The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection](https://agentprime.io/advisories/CVE-2026-7210.md)
  `CVE-2026-7210` · CVE record: Python Software Foundation CPython · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-331
- [Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs](https://agentprime.io/advisories/GHSA-2cwr-gcf9-pvxr.md)
  `GHSA-2cwr-gcf9-pvxr`, `CVE-2026-42155`, `PKSA-qjnm-jjkr-qktb` · Packagist `openmage/magento-lts`: affected `<20.18.0`, fixed in `20.18.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Weak cryptography or TLS, CWE-331
- [Weak webstax_auth Cookie Authentication Allows Privilege Escalation](https://agentprime.io/advisories/CVE-2026-2336.md)
  `CVE-2026-2336` · CVE record: Microchip IStaX · CVSS 8.7 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-331
- [libexpat: libexpat before 2.8.0 uses insufficient entropy…](https://agentprime.io/advisories/CVE-2026-41080.md)
  `CVE-2026-41080` · CVE record: libexpat project libexpat · CVSS 2.9 Low · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-331
- [Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption](https://agentprime.io/advisories/GHSA-ghc5-95c2-vwcv.md)
  `GHSA-ghc5-95c2-vwcv`, `PKSA-kmxg-njz7-dx5f` · Packagist `auth0/symfony`: affected `>=5.0.0, <5.8.0`, fixed in `5.8.0` · CVSS 8.2 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-331
- [Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption](https://agentprime.io/advisories/GHSA-vfpx-q664-h93m.md)
  `GHSA-vfpx-q664-h93m`, `PKSA-rbsn-2z23-mspc` · Packagist `auth0/wordpress`: affected `>=5.0.0-BETA0, <5.6.0`, fixed in `5.6.0` · CVSS 8.2 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-331
- [Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption](https://agentprime.io/advisories/GHSA-fmg6-246m-9g2v.md)
  `GHSA-fmg6-246m-9g2v`, `PKSA-9fpd-p7cq-9hfg` · Packagist `auth0/login`: affected `>=7.0.0, <7.21.0`, fixed in `7.21.0` · CVSS 8.2 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-331
- [Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption](https://agentprime.io/advisories/GHSA-w3wc-44p4-m4j7.md)
  `GHSA-w3wc-44p4-m4j7`, `CVE-2026-34236`, `PKSA-3nzc-cgjr-2gwf` · Packagist `auth0/auth0-php`: affected `>=8.0.0, <8.19.0`, fixed in `8.19.0` · CVSS 8.2 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-331
- [libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure](https://agentprime.io/advisories/GHSA-434v-x5qv-pmh6.md)
  `GHSA-434v-x5qv-pmh6`, `RUSTSEC-2026-0075` · crates.io `libcrux-ed25519`: affected `<0.0.7`, fixed in `0.0.7` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-331, CWE-392, CWE-1240
- [Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-2878.md)
  `CVE-2026-2878` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-331
- [Glibc: vdso getrandom acceleration may return predictable randomness](https://agentprime.io/advisories/CVE-2025-0577.md)
  `CVE-2025-0577` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-331
- [Micca KE700 Brute-force vulnerability due to low entropy](https://agentprime.io/advisories/CVE-2026-2541.md)
  `CVE-2026-2541` · CVE record: Micca Auto Electronics Co., Ltd. Car Alarm System KE700 · CVSS 6.4 Medium · Not analysed yet · Published 15 Feb 2026 · Tags: CWE-331
- [DPA countermeasures not reseeded under certain conditions](https://agentprime.io/advisories/CVE-2025-7432.md)
  `CVE-2025-7432` · CVE record: silabs.com Simplicity SDK · CVSS 1.0 Low · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-331
- [Rapid7 Nexpose Insecure Java Keystore Password Generation](https://agentprime.io/advisories/CVE-2026-1814.md)
  `CVE-2026-1814` · CVE record: Rapid7 InsightVM/Nexpose · CVSS 6.8 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-331
- [Insecure Encryption in Communication with the Web Interface on TP-Link VX800v](https://agentprime.io/advisories/CVE-2025-13399.md)
  `CVE-2025-13399` · CVE record: TP-Link Systems Inc. VX800v v1.0 · CVSS 7.7 High · Not analysed yet · Published 29 Jan 2026 · Tags: CWE-331
- [SM2-PKE has 32-bit Biased Nonce Vulnerability](https://agentprime.io/advisories/GHSA-w3g8-fp6j-wvqw.md)
  `GHSA-w3g8-fp6j-wvqw`, `CVE-2026-22698` · crates.io `sm2`: affected `>=0.14.0-pre.0, <=0.14.0-rc.4`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-331
- [Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass](https://agentprime.io/advisories/CVE-2020-36925.md)
  `CVE-2020-36925` · CVE record: Arteco-Global Arteco Web Client DVR/NVR · CVSS 8.7 High · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-331
- [QNO Technology｜VPN Firewall - Insufficient Entropy](https://agentprime.io/advisories/CVE-2025-15387.md)
  `CVE-2025-15387` · CVE record: QNO Technology VPN Firewall · CVSS 8.7 High · Not analysed yet · Published 31 Dec 2025 · Tags: CWE-331
- [Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values in github.com/gofiber/utils](https://agentprime.io/advisories/GHSA-m98w-cqp3-qcqr.md)
  `GHSA-m98w-cqp3-qcqr`, `CVE-2025-66565`, `GO-2025-4208` · Go `github.com/gofiber/utils` and 1 more: affected `<1.2.0`, fixed in `1.2.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2025 · Tags: Weak cryptography or TLS, CWE-252, CWE-331
- [WBCE CMS has Weak Random Number Generator in Password Generation Function](https://agentprime.io/advisories/CVE-2025-67504.md)
  `CVE-2025-67504` · CVE record: WBCE WBCE_CMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Weak cryptography or TLS, CWE-331
- [Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges](https://agentprime.io/advisories/CVE-2025-14261.md)
  `CVE-2025-14261` · CVE record: Litmuschaos litmus · CVSS 7.1 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-331
- [KDE Connect verification-code protocol: The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and…](https://agentprime.io/advisories/CVE-2025-32898.md)
  `CVE-2025-32898` · CVE record: KDE KDE Connect verification-code protocol · CVSS 4.7 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-331
- [Mercku M6a: On Mercku M6a devices through 2.1.0, the authentication system uses predictable session…](https://agentprime.io/advisories/CVE-2025-62774.md)
  `CVE-2025-62774` · CVE record: Mercku M6a · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-331
- [Crypt::RandomEncryption for Perl uses insecure rand() function during encryption](https://agentprime.io/advisories/CVE-2024-58040.md)
  `CVE-2024-58040` · CVE record: QWER Crypt::RandomEncryption · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Weak cryptography or TLS, CWE-331
- [TYPO3 CMS uses insufficient entropy when generating passwords](https://agentprime.io/advisories/GHSA-p5jq-5383-qvc7.md)
  `GHSA-p5jq-5383-qvc7`, `CVE-2025-59015`, `PKSA-rwv7-ff55-f18g` · Packagist `typo3/cms-core`: affected `>=12.0.0, <12.4.37 || >=13.0.0, <13.4.18`, fixed in `12.4.37`, `13.4.18` · CVSS 6.3 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-331
- [The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended](https://agentprime.io/advisories/GHSA-8q6v-474h-whgg.md)
  `GHSA-8q6v-474h-whgg`, `CVE-2025-54885` · npm `thinbus-srp`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-331
- [A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artif…](https://agentprime.io/advisories/CVE-2025-50122.md)
  `CVE-2025-50122` · CVE record: Schneider Electric EcoStruxure™ IT Data Center Expert · CVSS 8.9 High · Not analysed yet · Published 11 Jul 2025 · Tags: CWE-331
- [D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropy](https://agentprime.io/advisories/CVE-2025-6931.md)
  `CVE-2025-6931` · CVE record: D-Link DCS-6517 and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 30 Jun 2025 · Tags: Weak cryptography or TLS, CWE-331
- [Meshtastic Repeated Public and Private Keypairs](https://agentprime.io/advisories/CVE-2025-52464.md)
  `CVE-2025-52464` · CVE record: meshtastic firmware · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2025 · Tags: CWE-331
- [Rallly Insufficient Password Login Token Entropy Leads to Account Takeover](https://agentprime.io/advisories/CVE-2025-47781.md)
  `CVE-2025-47781` · CVE record: lukevella rallly · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2025 · Tags: CWE-331
- [Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default](https://agentprime.io/advisories/CVE-2024-58134.md)
  `CVE-2024-58134` · CVE record: SRI Mojolicious · CVSS 8.1 High · Not analysed yet · Published 3 May 2025 · Tags: Hard-coded credentials, CWE-331
- [Crypt::CBC versions between 1.21 and 3.05 for Perl may use insecure rand() function for cryptographic functions](https://agentprime.io/advisories/CVE-2025-2814.md)
  `CVE-2025-2814` · CVE record: LDS Crypt::CBC · CVSS 4.0 Medium · Not analysed yet · Published 12 Apr 2025 · Tags: Weak cryptography or TLS, CWE-329, CWE-331
- [Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions](https://agentprime.io/advisories/CVE-2024-56370.md)
  `CVE-2024-56370` · CVE record: ELLIOTT Net::Xero · CVSS 6.5 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: Weak cryptography or TLS, CWE-331
- [WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions](https://agentprime.io/advisories/CVE-2024-52322.md)
  `CVE-2024-52322` · CVE record: LOCALSHOP WebService::Xero · CVSS 5.5 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: Weak cryptography or TLS, CWE-331
- [Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions](https://agentprime.io/advisories/CVE-2024-58036.md)
  `CVE-2024-58036` · CVE record: NORBU Net::Dropbox::API · CVSS 5.5 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: Weak cryptography or TLS, CWE-331
- [Web::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions](https://agentprime.io/advisories/CVE-2024-57868.md)
  `CVE-2024-57868` · CVE record: LEV Web::API · CVSS 5.5 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: Weak cryptography or TLS, CWE-331
- [Data::Entropy for Perl uses insecure rand() function for cryptographic functions](https://agentprime.io/advisories/CVE-2025-1860.md)
  `CVE-2025-1860` · CVE record: ZEFRAM Data::Entropy · CVSS 7.7 High · Not analysed yet · Published 28 Mar 2025 · Tags: Weak cryptography or TLS, CWE-331

Older: <https://agentprime.io/advisories/tag/cwe-331.md?cursor=WyIyMDI1LTAzLTI4VDAwOjU2OjA4LjY0NzAwMFoiLCJDVkUtMjAyNS0xODYwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-331>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-331/>. Everything for agents: <https://agentprime.io/llms.txt>.